[ news_security_news ]
Storm Worm Storms Back
David Utter
Staff Writer
2007-04-13
 Security News RSS Feed
ZIP files in password protected email bodies have replaced EXE files as the payload of choice for delivering Storm worm files to unsuspecting users.
Storm worm downloads have been flying around the Internet in a new form designed to elude antivirus detection.
Arbor Networks researcher Jose Nazario blogged about observing the escalated activity, and how the criminals behind the worm have shifted tactics to foil detection.
"There was some confusion throughout the day because these new payloads and tactics were being used, AV wasn't catching it, and vendors have a dozen names for this threat," he wrote. "That said, once we started to analyze it, sure enough it was the Storm Worm, our old friend."
A sample Storm worm spam using the newer tactics tries to entice the recipient to open the ZIP archive. This would unpack a 'patch' to fix a problem on the user's machine. Doing this installs the rootkit, which leads to further downloads of additional malware.
Antivirus companies should be catching up with their signature files and stopping the latest threat. Nazario said Arbor has been sharing information about this incarnation of the Storm worm with other security companies.
---
 
Tags: Storm worm, Trojan, Rootkit
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Security News RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
